Bump karaf to 4.3.0

Bump karaf to 4.3.0

Release notes:
https://issues.apache.org/jira/secure/ReleaseNote.jspa?projectId=12311140&version=12343304

This forces us to deal with jakarta.activation-api, as that is no
longer provided out of the box. We deal with that by providing our
own feature and ditching javax.activation declaration, hence we now
have odl-jakarta-activation-api.

We also upgrade to jackson-2.11.3, which finally puts an end to
all those serialization widgets vulns. Release notes:
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11.1
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11.2
https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.11.3

The resulting packaging ends up with two versions of servlet-api,
which is okay: pax-web can use undertow which supports it, while
jetty does not -- hence we have two versions. This will be rectified
once we have jetty-10.

Also org.osgi.core-6 is now osgi.core-7, creating a bit more transition
work than expected.

Change-Id: Ib34abcbf6948664e5c1f9381fdc8577dc4f62108
Signed-off-by: Robert Varga <robert.varga@pantheon.tech>